7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

max time kernel
123s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost_dump_SCY - Copy.exe
Size 5.2MB
Sample240123-rcvgnsbabl
SHA256 7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f
MD5 5fd3d21a968f4b8a1577b5405ab1c36a
SHA1 710e5ab0fceb71b982b966c3a7406ebdf1d2aa82
SHA512 085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f
SSDEEP 98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion trojan

Malware Config

Signatures

Detects BazaLoader malware 9 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

trojan

resource	yara_rule
behavioral1/memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/files/0x00140000000185e9-32.dat	BazaLoader
behavioral1/memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/files/0x00140000000185e9-30.dat	BazaLoader
behavioral1/files/0x00140000000185e9-27.dat	BazaLoader
behavioral1/files/0x00140000000185e9-26.dat	BazaLoader
behavioral1/memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader
behavioral1/memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp	BazaLoader

Modifies Windows Firewall 1 TTPs 4 IoCs

evasion

Windows Service

T1543.003

pid	Process
2640	netsh.exe
2876	netsh.exe
1964	netsh.exe
1928	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2044	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2060	svchost_dump_SCY - Copy.exe
2060	svchost_dump_SCY - Copy.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3040	powershell.exe
2612	powershell.exe
2060	svchost_dump_SCY - Copy.exe
1624	powershell.exe
108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3036	WMIC.exe
Token: SeSecurityPrivilege	3036	WMIC.exe
Token: SeTakeOwnershipPrivilege	3036	WMIC.exe
Token: SeLoadDriverPrivilege	3036	WMIC.exe
Token: SeSystemProfilePrivilege	3036	WMIC.exe
Token: SeSystemtimePrivilege	3036	WMIC.exe
Token: SeProfSingleProcessPrivilege	3036	WMIC.exe
Token: SeIncBasePriorityPrivilege	3036	WMIC.exe
Token: SeCreatePagefilePrivilege	3036	WMIC.exe
Token: SeBackupPrivilege	3036	WMIC.exe
Token: SeRestorePrivilege	3036	WMIC.exe
Token: SeShutdownPrivilege	3036	WMIC.exe
Token: SeDebugPrivilege	3036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3036	WMIC.exe
Token: SeRemoteShutdownPrivilege	3036	WMIC.exe
Token: SeUndockPrivilege	3036	WMIC.exe
Token: SeManageVolumePrivilege	3036	WMIC.exe
Token: 33	3036	WMIC.exe
Token: 34	3036	WMIC.exe
Token: 35	3036	WMIC.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe
Token: SeTakeOwnershipPrivilege	1680	WMIC.exe
Token: SeLoadDriverPrivilege	1680	WMIC.exe
Token: SeSystemProfilePrivilege	1680	WMIC.exe
Token: SeSystemtimePrivilege	1680	WMIC.exe
Token: SeProfSingleProcessPrivilege	1680	WMIC.exe
Token: SeIncBasePriorityPrivilege	1680	WMIC.exe
Token: SeCreatePagefilePrivilege	1680	WMIC.exe
Token: SeBackupPrivilege	1680	WMIC.exe
Token: SeRestorePrivilege	1680	WMIC.exe
Token: SeShutdownPrivilege	1680	WMIC.exe
Token: SeDebugPrivilege	1680	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1680	WMIC.exe
Token: SeRemoteShutdownPrivilege	1680	WMIC.exe
Token: SeUndockPrivilege	1680	WMIC.exe
Token: SeManageVolumePrivilege	1680	WMIC.exe
Token: 33	1680	WMIC.exe
Token: 34	1680	WMIC.exe
Token: 35	1680	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1680	WMIC.exe
Token: SeSecurityPrivilege	1680	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 3036	2060	svchost_dump_SCY - Copy.exe	29
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2640	2060	svchost_dump_SCY - Copy.exe	31
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 2876	2060	svchost_dump_SCY - Copy.exe	33
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 3040	2060	svchost_dump_SCY - Copy.exe	35
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 2612	2060	svchost_dump_SCY - Copy.exe	37
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 1468	2060	svchost_dump_SCY - Copy.exe	40
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2756	2060	svchost_dump_SCY - Copy.exe	42
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2060 wrote to memory of 2044	2060	svchost_dump_SCY - Copy.exe	45
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1680	2044	svchost.exe	44
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1964	2044	svchost.exe	48
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1928	2044	svchost.exe	52
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 1624	2044	svchost.exe	50
PID 2044 wrote to memory of 108	2044	svchost.exe	53
PID 2044 wrote to memory of 108	2044	svchost.exe	53
PID 2044 wrote to memory of 108	2044	svchost.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2640
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\schtasks.exe
  schtasks /delete /TN "Timer"
  2⤵
  PID:1468
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:2756
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1624
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:108

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 838a7d955be4fbf5466b0c184b5021c3f6791bc57253c2e00f785768ba5b0bb0
MD5 75ef91188e430aba34e5427bf534618f
SHA1 830c3d29594eae456d259e193ae47aa045b9486f
SHA512 d5cb95b842ae57cb81ebfbfb530edbd281d068e1334d663bb7f83492eca4b59811d17fa4b2cb291d512d95f7ba6b67dadf93cdb6ebdad50eb658a0a772d39494
SSDEEP 96:85aCNM83nqvsqvJCwoGf/5aCNM83nqvsEHyqvJCwor8fMV0XQHDj7SRXlUV9:kvrUoGfxvrAHnor8fMmuj7SRC
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.7MB
SHA256 2553820f11ff6d383401860b42b7ce8168950d72a9cef7434dfd4b372f0a10da
MD5 1a54941e69d95e9a46d184486f32ff9f
SHA1 fa94366a0032895f00742ef06e5663c888245847
SHA512 ddbdefd03d9d669c4e958542be9b87ed05c83289c17f4364858b4d412c7d91946d0b1f97e9279edded849d012b2e8bbc9db8af32bf32a22d8466d7caf253727b
SSDEEP 12288:g0hfu7GnJHUFw7arDf+EPInzcw/bOVO6j8SdM0pib9zCoU4yXD3c4lIajZSrm:d5UFM66EPZiOA/0cMzMAIOH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 2.5MB
SHA256 1e8e3f8d734f0231e66712969a4085524282d963a63c4c640fbcd18efee3f74c
MD5 1528f0ebb080f1b74256588e8524a332
SHA1 38070f730d23adf9610abdc9a3e0b13277b12b38
SHA512 578df244868090ef96ab6f6482e36ab1d960385ccbbbbf2b42ee2e59e020f3008a7ab36e4b5bb8dd9859bf31b3a35d7644254e80165b14112048c5992c03dfd0
SSDEEP 24576:LyQ8Z6vLpveyzDf29AonHy8I2ZaSoGXU/g6:LLWyOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\system\svchost.exe
Size 236KB
SHA256 5a2cf0f6f7db237679324b1b6156a11a367d60d17a81a8abfd57707adc801d57
MD5 2aecbf1749a77caa002df331f00e089d
SHA1 af2d9e19d3956b04d8324b090747803e86331820
SHA512 0ea13eb2902ccc39c26c927d4ae7a7cb4dde1566ee3de0691798948e078beef464228dcdb8c972bf0b9f7e1845ec3fd92473f04cbec0f41f5feba8f0a0a4bf71
SSDEEP 3072:sBLSB3WhdMXAo69CyftExxFb4XGDAIdMp/mdvYsMVuyZa5dcBQxO+NvDD7ww:o8GDHffmFbg1IdMp/mdAsMV7Az
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\system\svchost.exe
Size 53KB
SHA256 f9886644101c4967d410231a961843d35818d1086e105f6672a8e8107ce1e0a9
MD5 44a18a591accd89ac012ac1d48c6e367
SHA1 a4d2988e1504f13661682aeca813c96f7b6a0109
SHA512 10473e286fa6300c6a096b5e726cae00c409e30d59fd7fa7c40a71786c197a92164c97fc4b7295eb61839a030711c96d1797b140320e1d79dd8d45a901c4ecfa
SSDEEP 768:sb479GvGUluUEc4lLeMLoWDMOPEv8xb4cyvhdMXb01mCpxVJ6/hvZgjfjWGf:sgoeUl1SoaMOPEUdcvhdMXAcWQb6fFf
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 152KB
SHA256 d9d1b0d7191ee2be4a8d6a5689eadc1250bebe80f539652063ec31d8c832d505
MD5 86a73dd116657cbd0c6ad815d48beea8
SHA1 c11f9269f9465a388459caa9d5a83b18294a199e
SHA512 efdae5eb03afd622b3cf118e778413dded0355b3241da6008ebc2e86ebf44e2e4eed12c236758396b36593981fb093890802e77c492cd3e381c8520cfbad0fa6
SSDEEP 3072:sBLSB3WhdMXAo69CyftExxFb4XGDAIdMp/mdvYsMVuyZa5R:o8GDHffmFbg1IdMp/mdAsMV78
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 292KB
SHA256 eba7bf216f5728981e0cb3abb15deffdbe1a36da72085e3fc48d4a302ca553af
MD5 3fec225f8cdd4f87a721aafd61ebbd79
SHA1 63e6834ca1f8c8de94d2c28a88ea94ea45c2fa38
SHA512 0a8d10f8c5fa4c555523467011a678f4e09e7820a5e7f342845015f2009e47e2807afec0d02316e9fbf680fb2a530a6e286fcf71f42247a62bce8d962ef5aa96
SSDEEP 3072:sBLSB3WhdMXAo69CyftExxFb4XGDAIdMp/mdvYsMVuyZa5dcBQxO+NvDD7wwmMHx:o8GDHffmFbg1IdMp/mdAsMV7Az3HXnum
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/108-63-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/108-57-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/108-55-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/108-58-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/108-64-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/108-60-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/108-56-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/1624-59-0x0000000002964000-0x0000000002967000-memory.dmp

Download

memory/1624-47-0x0000000002960000-0x00000000029E0000-memory.dmp

Download

memory/1624-61-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/1624-53-0x0000000002960000-0x00000000029E0000-memory.dmp

Download

memory/1624-45-0x0000000002890000-0x0000000002898000-memory.dmp

Download

memory/1624-48-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/1624-46-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Download

memory/1624-44-0x000000001B5B0000-0x000000001B892000-memory.dmp

Download

memory/1624-62-0x000000000296B000-0x00000000029D2000-memory.dmp

Download

memory/2044-35-0x0000000140000000-0x0000000140636000-memory.dmp

Download

memory/2044-80-0x0000000140000000-0x0000000140636000-memory.dmp

Download

memory/2044-65-0x000000001ECF0000-0x000000001F1D2000-memory.dmp

Download

memory/2060-33-0x0000000140000000-0x0000000140636000-memory.dmp

Download

memory/2060-37-0x0000000140000000-0x0000000140636000-memory.dmp

Download

memory/2060-0-0x0000000140000000-0x0000000140636000-memory.dmp

Download

memory/2060-36-0x0000000040AF0000-0x0000000041126000-memory.dmp

Download

memory/2060-34-0x0000000040AF0000-0x0000000041126000-memory.dmp

Download

memory/2612-23-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Download

memory/2612-20-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/2612-19-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Download

memory/2612-21-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/2612-17-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/2612-22-0x0000000002D3B000-0x0000000002DA2000-memory.dmp

Download

memory/3040-18-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/3040-15-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/3040-13-0x0000000002950000-0x00000000029D0000-memory.dmp

Download

memory/3040-12-0x000007FEF4100000-0x000007FEF4A9D000-memory.dmp

Download

memory/3040-16-0x000000000295B000-0x00000000029C2000-memory.dmp

Download

memory/3040-14-0x0000000002954000-0x0000000002957000-memory.dmp

Download

memory/3040-6-0x0000000002A10000-0x0000000002A18000-memory.dmp

Download

memory/3040-5-0x000000001B500000-0x000000001B7E2000-memory.dmp

Download